Use restrictive permissions for batch account rather than Contributor access

[sushilkm]

Problem Currently we are grant the managed-identities the contributor access on batch account. This access is very open ended and could be a security issue.

Proposed Solution Lets make use of custom-roles to create a custom role with selective permissions on batch account and assign the custom-role to managed-identities as required.